Organizations
operating Azure Container Registries (ACR) require least-privilege permissions
over which Microsoft Entra identities can publish or consume container images.
With ACR repository permissions using attribute-based access control (ABAC),
administrators can now grant granular repository and namespace-level
permissions. This enables secure container registry operations by ensuring that
CI/CD pipelines and Kubernetes workloads can only perform image push, pull, or
delete operations on authorized repositories.
ABAC is available for both new and existing ACR
registries, across all SKUs, in all regions.
Learn more.